WordPress Plugin Vulnerabilities

Call Now Accessibility Button < 1.1 - Admin+ Stored XSS

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Proof of Concept

1. Fields in the "Options" section of the plugin are vulnerable to XSS. For example, the "Button Text" field is affected by the payload: `<script>alert('XSS')</script>`
2. Reload page to see XSS.

Affects Plugins

Plugin icon
accessibility-help-button
Fixed in 1.1

References

CVE
CVE-2023-2635
URL
https://packetstormsecurity.com/files/#171663/

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Original Researcher
Taliya Bilal
Submitter
Taliya Bilal
Verified
Yes
WPVDB ID
81b89613-18d0-4c13-84e3-9e2e1802fd7c

Timeline

Publicly Published
2023-06-19 (about 5 months ago)
Added
2023-06-19 (about 5 months ago)
Last Updated
2023-06-19 (about 5 months ago)

Other

Published
Title
Published
2023-11-14
Title
Footer Putter <= 6.1.3 - Reflected Cross-Site Scripting
Published
2023-08-21
Title
Min Max Control < 4.6 - Reflected XSS
Published
2020-07-13
Title
Findgo - Directory Listing < 1.3.32 - Unauthenticated Reflected and Authenticated Stored XSS
Published
2023-06-19
Title
TinyMCE Custom Styles < 1.1.4 - Admin+ Stored Cross-Site Scripting
Published
2020-08-10
Title
Admin Menu <= 1.1 - Authenticated Cross-Site Scripting (XSS)